# Privacy Policy **Free Me South Africa (Pty) Ltd** Registration Number: 2025/384802/07 Version 2.1 | Effective Date: 24 August 2026 *This Privacy Policy is published in compliance with Section 18 of the Protection of Personal Information Act 4 of 2013 ("POPIA") and the provisions of the Promotion of Access to Information Act 2 of 2000 ("PAIA").* --- ## 1. Who We Are Free Me South Africa (Pty) Ltd ("FMSA", "we", "us") is a private company registered in South Africa (Reg. 2025/384802/07). FMSA operates the Self-Exclusion Platform at www.freemesouthafrica.co.za, which enables individuals to formally self-exclude from gambling facilities under Section 14 of the National Gambling Act 7 of 2004 ("NGA"). **Information Officer (POPIA Section 1):** Pierre van Staden Founder and Chief Executive Officer exclusions@freemesouthafrica.co.za --- ## 2. Information We Collect ### 2.1 Personal Information | Category | Specific Data | Legal Basis (POPIA Section 11) | |---|---|---| | Identity | First name, last name, South African ID number | Section 11(1)(a) - data subject consent; Section 11(1)(c) - compliance with legal obligation (NGA) | | Contact | Email address, mobile number | Section 11(1)(a) - consent | | Physical descriptors | Height, build, eye colour, hair colour, distinguishing features | Section 11(1)(c) - NGB Form 1/1 statutory requirement (GG 26994) | | Account credentials | Password (bcrypt hashed, never stored in plain text) | Section 11(1)(a) - consent | | Geographic | Province of residence | Section 11(1)(a) - consent; required for PGB routing | | Gambling profile | Types of gambling engaged in, frequency, monthly spend, debt level | Section 11(1)(a) - consent; used for anonymised IGHAC reporting | | E-signature | Signature display, mode (typed/drawn), timestamp, SHA-256 hash | Section 11(1)(a) - consent; Section 11(1)(c) - NGA and ECTA compliance | ### 2.2 Special Personal Information (POPIA Section 26) POPIA Section 26 identifies certain categories of personal information as "special" and requires explicit, separate consent for their processing. **Race:** Race or ethnic origin is special personal information under POPIA Section 26 and requires explicit, separately obtained consent. Race information is required by NGB Form 1/1 for identification purposes and, if provided, will be included in the NGB Form 1/1 submitted to the NGB and provincial licensing authorities. Where you have also consented to IGHAC reporting, it may be shared with IGHAC in anonymised aggregate form only. Race information is not used for any other purpose. Your consent to provide race data is required for inclusion in the NGB Form 1/1. If you decline, FMSA will submit the form without the race field and note the omission. ### 2.3 Biometric Information (POPIA Section 26) **Facial image / ID photograph:** Captured during the identity verification step. The photograph is used to provide additional identity-verification evidence by linking you to the identity document you present. It is stored securely by FMSA for evidentiary purposes. Where DHA HANIS integration is in place, the photograph is also transmitted for biometric matching; until that integration is live, verification is based on the photograph itself. Biometric processing is subject to explicit consent and POPIA Section 26. See our Biometric and Special Data Notice for full details. ### 2.4 Technical Information | Data | Purpose | Retention | |---|---|---| | IP address (encrypted) | Audit trail, fraud prevention | 7 years | | Browser and OS type | Audit trail | 7 years | | Session tokens (hashed) | Authentication | Until expiry (8h access / 30d refresh) | | Audit log entries | Immutable compliance record | 7 years | --- ## 3. How We Use Your Information | Purpose | Legal Basis | |---|---| | Completing and submitting NGB Form 1/1 to the NGB and all 9 PGBs | POPIA Section 11(1)(c) - legal obligation under NGA | | Facilitating operator notification via the NGB's Regulation 2(4) transmission to all licensed operators (land-based and online) | POPIA Section 11(1)(c) - legal obligation; Section 11(1)(a) - your consent in the Proxy Consent Certificate | | Communicating with individual licensed operators to follow up on enforcement or report suspected breaches | POPIA Section 11(1)(a) - your express consent in the Proxy Consent and Authorisation Certificate | | Generating your FMSA Self-Exclusion Submission Certificate | POPIA Section 11(1)(c) - legal obligation | | Generating the Proxy Consent and Authorisation Certificate | POPIA Section 11(1)(a) - your consent | | Sending submission confirmation to your email | POPIA Section 11(1)(a) - your consent | | ID verification with Home Affairs | POPIA Section 11(1)(a) - your consent | | Mobile OTP verification | POPIA Section 11(1)(a) - your consent | | Maintaining an immutable audit trail | POPIA Section 11(1)(c) - ECTA, NGA compliance | | Anonymised IGHAC demographic reporting (race only, if consented) | POPIA Section 11(1)(a) - explicit separate consent | | Counselling referral via NRGP (if requested) | POPIA Section 11(1)(a) - your consent | --- ## 4. Sharing of Your Information We share your personal information only as follows: ### 4.1 Statutory Disclosure (Required by Law) **National Gambling Board:** We transmit NGB Form 1/1 and your personal details to the NGB as required by NGA Section 14. This is a mandatory statutory disclosure and cannot be withheld. **Provincial Gambling Boards:** Copies of your NGB Form 1/1 and Proxy Consent and Authorisation Certificate are sent to all nine Provincial Gambling Boards simultaneously with the NGB submission. This is required by NGA Section 14 and the operational requirements of the national SE register. **All Licensed Gambling Operators (via the NGB):** Under Regulation 2(4) of the National Gambling Regulations 2004, the NGB is required to transmit a copy of your exclusion notice to all licence holders within seven days of receiving your application. This means your exclusion details, including your name, South African ID number, physical descriptors, exclusion scope, and duration, will be transmitted to all licensed gambling operators in South Africa, both land-based and online. This transmission is a statutory obligation of the NGB and is the primary mechanism by which licensed operators are put on notice of your exclusion. FMSA's Proxy Consent and Authorisation Certificate also authorises FMSA to communicate with individual operators directly for the purpose of following up on enforcement where required. The nine Provincial Gambling Boards and their contact details are listed in our NGB and PGB Submission Notice, available under Legal Documents. ### 4.2 Service Providers (POPIA-Compliant Operators) | Service Provider | Data Shared | Purpose | Safeguards | |---|---|---|---| | OmniCheck | SA ID number | ID verification with Home Affairs | No photograph is sent; POPIA Section 21 operator obligations apply | | Clickatell | Mobile number | OTP delivery | RICA-compliant; number not stored beyond OTP session | | SMTP provider | Email address, name, PDF attachments | Statutory notification and certificate delivery | TLS encryption in transit | ### 4.3 No Sale of Personal Information FMSA does not sell, rent, trade, or monetise your personal information in any form. Your data is used exclusively for the purposes described in this policy. ### 4.4 Legal Compulsion We may be required to disclose your personal information to law enforcement, a court, or a regulatory authority. Where legally permissible, we will notify you of any such compelled disclosure. --- ## 5. International Transfers The Platform is hosted in South Africa and your personal information is stored in South Africa. Any transfer of personal information outside South Africa would be made only subject to POPIA Section 72, which requires that the receiving party is subject to a law substantially similar to POPIA or is bound by a binding legal instrument that provides equivalent protection. --- ## 6. Security We implement the following technical and organisational security measures: - **AES-256-GCM encryption** at the database column level for all personal information fields - **bcrypt** password hashing (no plain-text passwords stored) - **SHA-256** hashing for all ID numbers used in operator verification lookups - **HTTPS/TLS 1.3** for all data in transit - **JWT tokens** with short expiry (8h access / 30d refresh) - **Helmet.js** security headers (HSTS, CSP, COEP, CORP) - **Rate limiting** to prevent brute-force attacks - **Immutable audit trail** for all access and modification events - **Role-based access control** ensuring staff see only the data their role requires In the event of a data breach that poses a risk to your rights and freedoms, FMSA will notify the Information Regulator within 72 hours of becoming aware of the breach, and will notify you without undue delay, as required by POPIA Section 22. --- ## 7. Retention | Data Category | Retention Period | Reason | |---|---|---| | SE registration record (excluding PII) | 30 years | NGA statutory record-keeping | | Personal information (PII columns, encrypted) | Duration of SE + 7 years | NGA compliance; audit trail | | NGB Form 1/1 (PDF) | 30 years | Statutory document retention | | Proxy Consent Certificate (PDF) | 30 years | Statutory document retention | | Audit log entries | 7 years | ECTA and NGA compliance | | Session tokens | Until expiry | Authentication only | | Biometric data (facial image) | Not retained beyond verification | POPIA Section 26 minimisation | | Race data (if provided) | Anonymised on receipt; original deleted after IGHAC submission | POPIA Section 26 minimisation | After the retention period expires, your personal information will be securely deleted or de-identified in accordance with our data destruction policy. --- ## 8. Your Rights Under POPIA Sections 23-25, you have the right to: **Section 23 - Access:** Request confirmation of whether FMSA holds personal information about you, and access that information. Submit requests to exclusions@freemesouthafrica.co.za. FMSA will respond within 30 days. **Section 24 - Correction and deletion:** Request correction of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained personal information. Note: information forming part of your statutory SE record (NGB Form 1/1 data) cannot be altered after submission without creating an amended statutory record. **Section 25 - Objection:** Object to the processing of your personal information. Note that objection to processing required by law (NGA submission) cannot be granted without withdrawing your SE application. **Withdrawal of consent:** You may withdraw consent for optional processing (such as IGHAC race data or counselling referrals) at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. To exercise your rights, contact the Information Officer at exclusions@freemesouthafrica.co.za. --- ## 9. Complaints If you believe FMSA has not handled your personal information in accordance with POPIA, you may lodge a complaint with: **The Information Regulator (South Africa)** Website: https://inforegulator.org.za (see the website for current contact details and the complaints process) We encourage you to contact FMSA first at exclusions@freemesouthafrica.co.za before lodging a formal complaint. We will endeavour to resolve any concern within 10 business days. --- ## 10. Cookies FMSA uses session cookies necessary for authentication. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. See our Cookie Policy for full details. --- ## 11. Changes to This Policy Material changes to this Privacy Policy will be communicated by email to all registered users at least 14 days before the change takes effect. The version number and effective date at the top of this document will be updated accordingly. --- *Free Me South Africa (Pty) Ltd | Reg. 2025/384802/07 | exclusions@freemesouthafrica.co.za* *Compliance: POPIA (Protection of Personal Information Act 4 of 2013), PAIA (Promotion of Access to Information Act 2 of 2000), NGA (National Gambling Act 7 of 2004), ECTA (Electronic Communications and Transactions Act 25 of 2002)*